Privacy Policy

1. Information We Collect

Information You Provide

When you create a Vineyard account or use our services, we collect:

• Account information: name, email address, password (stored as a secure hash), phone number, and zip code
• Profile information: property address, property type, and profile photo or company logo (stored locally on your device and optionally synced to your account)
• Provider information: business name, license number, insurance details, trade categories, and service area
• Project information: job descriptions, scope of work, messages between homeowners and providers, and milestone details
• Financial information: payment method details (handled by Stripe — we never see your full card number), and financing application data (handled by Synchrony Bank)

Information Collected Automatically

• UTM attribution data: marketing source, medium, campaign, and content parameters collected at signup to understand how you found Vineyard
• Session activity: timestamps of your last activity, used solely for the 30-minute auto-logout security feature
• Device and browser information: browser type, operating system, and IP address for security and fraud prevention

Information from Third Parties

• Google Calendar: if you connect your Google Calendar, we receive your calendar ID and OAuth refresh token to sync appointments. We access only calendar events created by Vineyard.
• Stripe: payment status, payout information, and Connect account details for providers
• Synchrony Bank: financing application decisions and approved credit limits

2. How We Use Your Information

We use the information we collect to:

• Create and manage your Vineyard account
• Connect homeowners with verified home service providers
• Facilitate milestone-based payments and payouts
• Sync appointments with Google Calendar when you authorize this feature
• Process financing applications through Synchrony Bank
• Send appointment reminders, milestone notifications, and project updates
• Verify provider licenses, insurance, and identity
• Detect and prevent fraud, abuse, and security incidents
• Improve our platform based on usage patterns
• Comply with legal obligations

We do not use your information to serve third-party advertisements or sell it to data brokers.

3. How We Share Your Information

We share your information only in these circumstances:

• Between homeowners and providers: when you engage with a provider on a project, basic profile information (name, contact details) is shared to facilitate the work
• Service providers: we use Stripe (payments), Synchrony Bank (financing), Google (calendar), and Railway (infrastructure). Each is bound by data processing agreements.
• Legal requirements: we may disclose information if required by law, court order, or to protect the rights and safety of Vineyard users
• Business transfers: if Vineyard is acquired or merges with another company, your information may be transferred as part of that transaction, with advance notice provided

We never sell your personal information to third parties.

4. Google Calendar Integration

Vineyard's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect Google Calendar:

• We request access only to your Google Calendar to create, update, and delete appointment events created by Vineyard
• We store an OAuth refresh token to maintain calendar sync without requiring you to re-authorize
• We do not read, store, or analyze existing calendar events that were not created by Vineyard
• We do not use your Google Calendar data for advertising or share it with third parties
• You can revoke calendar access at any time from your provider dashboard or from your Google Account settings at myaccount.google.com
• When you disconnect, we immediately delete your refresh token and stop all calendar sync

5. Stripe Payments

All payment processing is handled by Stripe, Inc. Vineyard never stores your full credit card number, CVV, or bank account details on our servers.

• Card details are tokenized by Stripe and stored in Stripe's secure vault
• We store only your Stripe Customer ID and the last 4 digits/expiry of saved cards for display purposes
• Provider payouts are processed through Stripe Connect — payout account details are stored and managed by Stripe
• Stripe's privacy policy is available at stripe.com/privacy

6. Synchrony Financing

Financing applications submitted through Vineyard are processed by Synchrony Bank, a federally chartered bank subject to federal privacy laws.

• Your financing application data (including the last 4 digits of your SSN) is transmitted directly to Synchrony Bank and is not stored on Vineyard's servers
• We store only your application status, approved credit limit, and application ID returned by Synchrony
• Synchrony's privacy notice governs how they handle your financial data
• Applying for financing may result in a credit inquiry as disclosed during the application process

7. Data Security

We implement industry-standard security measures to protect your information:

• All data transmitted between your browser and Vineyard is encrypted using TLS/HTTPS
• Passwords are hashed using bcrypt with a work factor of 12 — we cannot retrieve your password
• Authentication uses short-lived JWT access tokens (7 days) and rotating refresh tokens
• Sessions automatically expire after 30 minutes of inactivity
• Our database is hosted on Railway's infrastructure with encryption at rest
• OAuth tokens for Google Calendar are stored encrypted

No system is 100% secure. If you believe your account has been compromised, contact us immediately at support@vineyardhome.io.

8. Data Retention

We retain your information for as long as your account is active or as needed to provide services:

• Account data: retained until you request deletion
• Project and payment records: retained for 7 years for financial and legal compliance
• Google Calendar tokens: deleted immediately upon disconnection
• Refresh tokens: expire after 30 days or upon logout, whichever comes first
• Inactive accounts: accounts with no activity for 3 years may be deleted with 30 days' notice

9. Your Rights & Choices

You have the following rights regarding your personal information:

• Access: request a copy of the personal data we hold about you
• Correction: update inaccurate information through your dashboard or by contacting us
• Deletion: request deletion of your account and associated data (subject to legal retention requirements)
• Portability: request your data in a machine-readable format
• Opt-out: unsubscribe from marketing emails at any time using the link in any email
• Google Calendar: disconnect at any time from your provider dashboard

California residents have additional rights under the CCPA. Virginia, Colorado, and Connecticut residents have rights under their respective state privacy laws. To exercise any of these rights, email support@vineyardhome.io.

10. Children's Privacy

Vineyard is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected information from a child, please contact us at support@vineyardhome.io and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Send an email notification to all registered users
• Display a notice in the Vineyard dashboard for 30 days

Continued use of Vineyard after changes take effect constitutes acceptance of the updated policy.